Netty CVE-2026-50020

Exploitation requires a multi-tier HTTP deployment where a front-end intermediary (reverse proxy, CDN edge, load balancer) and the Netty back-end disagree on the interpretation of non-CRLF ISO control characters (0x00-0x1F excluding 0x0D/0x0A, and 0x7F) in the pre-request-line byte stream, specifically over HTTP/1.1 pipelined or HTTP/2-to-HTTP/1.1 multiplexed transports. No authentication is required (PR:N per CVSS vector). The front-end must not strip or reject those control bytes before forwarding, and the transport must support request pipelining or multiplexing so that request-boundary confusion can affect multiple logical requests. Direct Netty deployments without a front-end proxy that parses HTTP boundaries are not exploitable via this desync mechanism, since there is no second interpretation to collide with. The CVSS AC:L designation does not reflect this multi-component dependency - practical exploitation is constrained to specific infrastructure configurations.

The NVD-assigned CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) captures network reachability and lack of authentication barriers, but the AC:L assignment appears optimistic: successful exploitation realistically requires a specific multi-tier deployment where a front-end component parses or strips the injected control bytes differently than Netty does - a condition more accurately reflected by AC:H. Conversely, the S:U designation may understate impact, since request smuggling characteristically allows an attacker to poison the request stream for other users, implying a scope change (S:C). EPSS at 0.04% (12th percentile) signals negligible current automated exploitation activity, and there is no CISA KEV listing. No POC has been identified at time of analysis. The practical risk concentrates in multi-tier HTTP infrastructures (CDN → Netty, nginx/HAProxy → Netty) where the front-end does not sanitize or uniformly reject non-CRLF control bytes; in direct-to-Netty deployments without such a front-end, the desync condition cannot be triggered. The Integrity:Low rating from NVD aligns with the smuggling primitive but does not fully capture the potential for cross-user request poisoning in shared-backend deployments.

An attacker targeting a deployment where a front-end reverse proxy (e.g., nginx or HAProxy) forwards pipelined HTTP/1.1 connections to a Netty-based back-end crafts a request that embeds NUL or other ISO control bytes immediately before the HTTP method token. The front-end treats those bytes as request delimiters or ignores them at the connection level, while Netty's HttpObjectDecoder silently discards them and parses what follows as a new request from the attacker. This desync allows the attacker to prepend arbitrary content to a subsequent victim user's request, potentially hijacking their session, forging authentication headers, or accessing back-end endpoints that should be unreachable from the external network.